TuxBot v3 Evolution: Keksec-Linked IoT/Linux Botnet with Verbatim LLM Chain-of-Thought Code Artifacts
TuxBot v3 Evolution (TL-2026-1397), also tracked as TuxBot v3 Evolution, is a medium-severity malware campaign, first published 2026-07-16. It is attributed to Keksec-affiliated developer with medium confidence, affects Multiple IoT/embedded device vendors 30+ IoT device families with, references 10 CVEs (CVE-2013-7471, CVE-2014-8361, CVE-2017-17215), maps to 17 MITRE ATT&CK techniques (T1027, T1036, T1059), and is covered by 9 detection rules and 29 indicators of compromise.
Key facts for TL-2026-1397
- Threat ID
- TL-2026-1397
- Also known as
- TuxBot v3 Evolution, Akiru
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-16
- Last reviewed
- 2026-07-16
- Attribution
- Keksec-affiliated developer
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- iot-consumer-devices, telecoms, critical-infrastructure-embedded-systems
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in TuxBot v3 Evolution
Malware and tooling: Kaitori v3.9, TuxBot v3 Evolution, aisuru, MHDDoS
TuxBot v3 Evolution is a multi-architecture IoT/Linux botnet framework (bot agent plus Go-based C2 with DDoS-for-hire capability) sharing dropper and C2 infrastructure with Kaitori v3.9 and AISURU, placing its operator inside the Keksec ecosystem. Source files contain raw, unremoved LLM chain-of-thought reasoning and a safety disclaimer the AI appended when asked to generate botnet code, and roughly 70% of its exploit/attack functionality is broken due to implementation bugs (magic-number mismatches, wrong XOR keys, hallucinated crypto).
How TuxBot v3 Evolution works
Palo Alto Networks Unit 42 (Chris Navarrete, Asher Davila, Doel Santos) disclosed TuxBot v3 Evolution, a previously unreported IoT botnet framework consisting of a C-based bot agent that cross-compiles for ARM, ARM64, MIPS, MIPSEL, MIPS64, x86_64, PowerPC, RISC-V, s390x and other architectures (17 total build targets), paired with a Go-based command-and-control server offering DDoS-for-hire functionality over a custom protocol, an interactive SSH admin shell (TCP 2222), and a JSON machine API (TCP 9999). The framework's lineage traces to Mirai, AISURU, and the undisclosed 'Wuhan' botnet family, with DDoS attack code partially ported from the open-source MHDDoS Python toolkit (78 nominal attack vectors mapped to only 6 functional handlers, including Slowloris, Apache Range, and WordPress XMLRPC pingback floods carried over as dead code).
The most novel finding is development tradecraft rather than technical sophistication: multiple C source files retain raw LLM chain-of-thought reasoning left verbatim in comments -- self-interruptions, internal decision narration, and direct references to 'the user' (the developer who prompted the model) -- indicating the bot's exploit VM, crypto layer, and DGA were substantially LLM-generated and shipped without review. Every .c file in the bot directory carries an unremoved AI safety disclaimer header ('for educational and authorized security research only'), and the LLM hallucinated a Argon2id key-derivation implementation that the developer shipped without verifying; at runtime it silently falls back to PBKDF2-SHA256 while still claiming Argon2id in its packet framing.
Operationally, the malware is roughly 70% functional. Its Telnet brute-forcer (1,496 credential pairs sourced from a 'DDOS-ROOTSEC pass_file' set, XOR-obfuscated with key 0xB4), ADB scanner, and SSH/HTTP scanners work as intended and represent the primary functional infection vector. Of 25 embedded IoT-exploit CVE targets, 13 are dead code never invoked, and 12 more are non-functional because the custom exploit-VM compiler emits magic value 0x54555845 ('TUXE') while the VM runtime expects 0x4558504C ('EXPL') -- a build/runtime mismatch that silently breaks every compiled exploit. IRC and HTTP C2 fallback channels are similarly broken due to a string-table XOR key mismatch (entries encrypted with 0x54, decrypted at runtime with 0xB4).
Working C2 channels use X25519 key exchange and ChaCha20-Poly1305 authenticated encryption with a 0xDEADBE01 handshake magic and 0xDEADBEEF packet magic; a SHA-512-based DGA (seed format '%04d-%02d-%02d-TuxBotv3-Evolution-Seed-2025-%d', 20 candidates/day across six TLDs) and a TCP 13337 P2P gossip protocol using Ed25519 signatures provide resilience if the primary C2 (209.182.237.133) is taken down. A dropper server at 185.10.68.127 (Iceland, FlokiNET bulletproof hosting) also serves Kaitori v3.9 binaries at the same path convention, directly linking TuxBot's operator to the Keksec/AISURU DDoS-for-hire ecosystem; passive DNS on that IP surfaces additional DDoS-for-hire domains active since 2021 (vrunabo.su, rezy1337.ted.ge, high.cpu.co.ua). Development artifacts trace a leaked internal hostname (newtuxdev.sevielw.digikalas.online) and a developer-registered domain (digikalas.online, Namecheap, Icelandic WHOIS privacy, hosted on Iranian Arvan Cloud) back to a January 2025 MHDDoS git clone, with production-quality (GCC 14.2.0) samples still being built and benchmarked as of April 2026.
MITRE ATT&CK techniques used in TL-2026-1397
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1568 Dynamic Resolution; T1573 Encrypted Channel
Discovery
T1082 System Information Discovery
Credential Access
Initial Access
T1190 Exploit Public-Facing Application
Lateral Movement
T1210 Exploitation of Remote Services
Impact
T1496 Resource Hijacking; T1498 Network Denial of Service
Persistence
T1543 Create or Modify System Process
Resource Development
T1583 Acquire Infrastructure; T1588 Obtain Capabilities
Reconnaissance
Affected products and versions in TuxBot v3 Evolution
- Multiple IoT/embedded device vendors — 30+ IoT device families with Telnet/SSH/HTTP/ADB management interfaces (targeted by embedded exploit-VM code and 1,496-entry credential brute-force list)
Vulnerable versions: devices affected by the 10 embedded CVEs listed in cve_list
Fixed in: vendor firmware releases patching the respective CVEs
Remediation for TuxBot v3 Evolution
Patches
- Apply vendor firmware updates addressing CVE-2013-7471, CVE-2014-8361, CVE-2017-17215, CVE-2018-10561, CVE-2020-8515, CVE-2022-1388, CVE-2022-22965, CVE-2022-30525, CVE-2022-44877, and CVE-2023-39780 on any affected embedded/IoT/management devices, since these are the vulnerabilities embedded in the bot's exploit-VM code paths
Immediate actions
- Block outbound/inbound traffic to 209.182.237.133 (primary C2), 185.10.68.127 (dropper), and 188.166.2.226 (Tsunami payload host) at the perimeter
- Sinkhole or block DNS resolution to digikalas[.]online, jetross[.]com, c2.tuxbot.local, and the passive-DNS-linked domains vrunabo[.]su, rezy1337.ted[.]ge, high.cpu.co[.]ua
- Force-rotate default/weak Telnet, SSH, and ADB credentials on all IoT/embedded devices; disable Telnet and ADB-over-network where not operationally required
- Hunt for the persistence indicators sd-pam.service (systemd unit), /tmp/.%08x.lock lock files, and console banner 'Infected By Akiru' on Linux/embedded hosts
Workarounds
- Disable unused management interfaces (Telnet, ADB-over-TCP, exposed HTTP admin panels) on IoT devices until firmware can be patched
- Rate-limit or block inbound connection attempts on TCP 1999, 31337, 2222, 9999, and 13337 from untrusted networks where these ports are exposed on management infrastructure
Longer-term hardening
- Deploy network egress monitoring/IDS signatures for the 0xDEADBEEF C2 packet magic, 0xDEADBE01 handshake magic, and the SHA-512 TuxBotv3-Evolution DGA seed pattern
- Segment IoT/embedded device networks from general enterprise traffic and enforce default-deny egress for devices with no legitimate need for outbound Internet access
- Maintain an IoT firmware patch/inventory program covering the CVEs this framework targets, since future TuxBot builds may fix the current exploit-VM magic-number bug and reactivate dormant exploit code
- Monitor for reuse of the FlokiNET/Iceland and Arvan Cloud/Iran hosting patterns and Namecheap WHOIS-privacy registration style associated with this operator cluster
CVEs associated with TuxBot v3 Evolution
CVE-2013-7471, CVE-2014-8361, CVE-2017-17215, CVE-2018-10561, CVE-2022-30525, CVE-2023-39780, CVE-2020-8515, CVE-2022-1388, CVE-2022-22965, CVE-2022-44877
Weaknesses (CWE) in TuxBot v3 Evolution
CWE-798, CWE-306, CWE-327
Timeline of TuxBot v3 Evolution
- Developer clones the open-source MHDDoS Python DDoS toolkit from GitHub; internal hostname newtuxdev.sevielw.digikalas.online later leaks this connection.
- Domain digikalas[.]online registered via Namecheap with Icelandic WHOIS privacy protection, later hosted on Iranian Arvan Cloud.
- 254 automated DDoS benchmark reports generated over a three-day window (Jan 4-6, 2026), indicating active development/testing of attack modules.
- First TuxBot sample (debug build) submitted to VirusTotal, hash 71dfbb171eca4ef9d02ff630b56e5283bbef7b375d4dbe9e8c9531bef312fa8d.
- TuxBot C2 server first observed on Palo Alto Networks Xpanse.
- Six new production-quality samples detected, compiled with GCC 14.2.0, indicating continued active development.
- Palo Alto Networks Unit 42 (Chris Navarrete, Asher Davila, Doel Santos) publicly discloses TuxBot v3 Evolution, including the LLM chain-of-thought artifacts and Keksec/Kaitori/AISURU infrastructure links; covered same-day by The Hacker News.
- TL-Intel Harness opens TL-2026-1397 to track TuxBot v3 Evolution and its Keksec ecosystem linkage.
Sources cited for TuxBot v3 Evolution
- TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development
- TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development
- TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development (forum mirror)
- TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development (forum mirror)
- TuxBot v3 Evolution (Akiru) Framework Analysis
- TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development
Threats related to TuxBot v3 Evolution
- TuxBot v3 Evolution: LLM-Assisted IoT Botnet Framework With a Broken Multi-CVE Exploit Chain
- P2P Botnets in the Wild: Pink, Hajime, Mozi, FritzFrog, and Panchan — Decentralized C2 Landscape (360 Netlab Continuous Monitoring)
- RustDuck Botnet Rebuilt in Rust with Enhanced C2 Capabilities and Multi-Vector Exploitation
- WeedHack MaaS Campaign: Minecraft Fake Mod Loader with RSA-Signed Blockchain C2 (LoaderClient)
Detection coverage for TL-2026-1397
As of 2026-07-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1397 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.